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In the Claims 

1. (Previously presented) A computer-implemented method for maintaining 
security of a computer system, the computer comprising a memory and a central processing 
unit, comprising: 

determining an initial system certainty value for the computer system; 
providing access to a database of signatures, each signature including a signature 
certainty value; 

receiving data; 

comparing the received data with the database of signatures; 

increasing the system certainty value if the received data does not match a signature in 
the database; 

decreasing the system certainty value if the received data matches a signature in the 
database; and 

filtering the data based on the system certainty value and the signature certainty value 
of a signature matching the received data. 

2. (Original) The method of claim 1, wherein the data that does not match a 
signature in the database is forwarded to its destination. 

3. (Original) The method of claim 1, wherein the increased or decreased 
certainty value becomes the initial system value. 

4. (Original) The method of claim 1, wherein the data comprises a packet of 

data. 

5. (Previously Presented) The method of claim 1, wherein the filtering further 
comprises forwarding the data if the signature certainty value is less than the system certainty 
value; and discarding the data if the signature certainty value is greater than the system 
certainty value. 
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6. (Original) The method of claim 5, wherein the step of forwarding further 
comprises generating a message log to indicate that data matching a signature was forwarded. 

7. (Original) A system for maintaining computer security, comprising: 
means for determining an initial system certainty value for the computer system; 
means for providing access to a database of signatures, each signature including a 

signature certainty value; 

means for receiving data; 

means for comparing the received data with the database of signatures; 

means for increasing the system certainty value if the received data does not match a 
signature in the database; 

means for decreasing the system certainty value if the received data matches a 
signature in the database; and 

means for filtering the data based on the system certainty value and the signature 
certainty value of a signature matching the received data. 

8. (Original) The system of claim 7, wherein the data that does not match a 
signature in the database is forwarded to its destination. 

9. (Original) The system of claim 7, wherein the increased or decreased 
certainty value becomes the initial system value. 

10. (Original) The system of claim 7, wherein the data comprises a packet of data. 

1 1 . (Previously Presented) The system of claim 7, wherein the means for filtering 
further comprises means for forwarding the data if the signature certainty value is less than 
the system certainty value; and discarding the data if the signature certainty value is greater 
than the system certainty value. 

12. (Original) The system of claim 11, wherein the means for forwarding further 
comprises means for generating a message log to indicate that data matching a signature was 
forwarded. 
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13. (Original) A computer recording medium including computer executable code 
for maintaining security of a computer system, comprising: 

code for determining an initial system certainty value for the computer system; 
code for providing access to a database of signatures, each signature including a 
signature certainty value; 

code for receiving data; 

code for comparing the received data with the database of signatures; 

code for increasing the system certainty value if the received data does not match a 
signature in the database; 

code for decreasing the system certainty value if the received data matches a signature 
in the database; and 

code for filtering the data based on the system certainty value and the signature 
certainty value of a signature matching the received data. 

14. (Original) The computer recording medium of claim 13, wherein the data that 
does not match a signature in the database is forwarded to its destination. 

15. (Original) The computer recording medium of claim 13, wherein the 
increased or decreased certainty value becomes the initial system value. 

16. (Original) The computer recording medium of claim 13, wherein the data 
comprises a packet of data. 

17. (Previously Presented) The computer recording medium of claim 13, wherein 
the code for filtering further comprises code for forwarding the data if the signature certainty 
value is less than the system certainty value; and discarding the data if the signature certainty 
value is greater than the system certainty value. 

18. (Original) The computer recording medium of claim 17, wherein the code for 
forwarding further comprises code for generating a message log to indicate that data 
matching a signature was forwarded. 
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19. (Previously presented) A system for maintaining computer security, 
comprising: 

a computer comprising a memory and a central processing unit, the computer being 
operable to: 

determine an initial system certainty value for the computer system; 
provide access to a database of signatures, each signature including a signature 
certainty value; 

receive data; 

compare the received data with the database of signatures; 

increase the system certainty value if the received data does not match a 
signature in the database; 

decrease the system certainty value if the received data matches a signature in 
the database; and 

filter the received data based on the system certainty value and the signature 
certainty value of a signature matching the received data. 

20. (Previously Presented) The system of claim 19, wherein if the received data 
does not match a signature in the database, the received data is forwarded to an intended 
destination. 

21. (Previously Presented) The system of claim 19, wherein the increased or 
decreased system certainty value becomes the initial system certainty value. 

22. (Previously Presented) The system of claim 19, wherein the data comprises a 
packet of data. 
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23. (Previously Presented) The system of claim 19, wherein the computer is 
further operable to: 

forward the received data if the signature certainty value is less than the system 
certainty value; and 

discard the received data if the signature certainty value is greater than the system 
certainty value. 

24. (Previously Presented) The system of claim 23, wherein the computer is 
further operable to generate a message log to indicate that received data matching a signature 
was forwarded. 
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